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' UNITED STATES 

FOREIGN INTELLIGENCE SURVEILLANCE COURT 
WASHINGTON, D.C. 

IN RE APPLICATION OF THE FEDERAL 
BUREAU OF INVESTIGATION FOR AN 
ORDER REQUIRING THE PRODUCTION 
OF TANGIBLE THINGS FROM BSSlil 




PRIMARY ORDER 

A verified application having been made by the Director of 
the Federal Bureau of Investigation (FBI) for an order pursuant 
to the Foreign Intelligence Surveillance Act of 1978 (the Act) , 
Title 50, United States Code (U.S.C.)/ § 1861, as amended, 

requiring the production to the National Security Agency (NSA) 
of the tangible things described below, and full consideration 
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having been given to the matters set forth therein, the Court 
finds as follows: 

1. There are reasonable grounds to believe that the 
tangible things sought are relevant to authorized investigations 
(other than threat assessments) being conducted by the FBI under 
guidelines approved by the Attorney General under Executive 
Order 12333 to protect against international terrorism, which 
investigations are not being conducted solely upon the basis of 
activities protected by the First Amendment to the Constitution 
of the United States. [50 U.S.C. § 1861(c)(1)] 

2. The tangible things sought could be obtained with a 
subpoena duces tecum issued by a court of the United States in 
aid of a grand jury investigation or with any other order issued 
by a court of the United States directing the production of 
records or tangible things. [50 U.S.C. § 1861(c) (2) (D) ] 

3. The application includes an enumeration of the 

minimization procedures the government proposes to follow with 
regard to the tangible things sought. Such procedures are 
substantively the same as the minimization procedures approved 
and adopted as binding by the order of this Court in Docket 
Number BR 09-01. [50 U.S.C. § 1861(c)(1)] 

Accordingly, the Court finds that the application of the 
United States to obtain the tangible things, as described below, 

TOP SECRET//COMINT/flVOFORN 



2 



TOP SECRET//COMINT//NOFORN 



satisfies the requirements of the Act and, therefore, 

IT IS HEREBY ORDERED, pursuant to the authority conferred 
on this Court by the Act, that the application is GRANTED, and 
it is 

FURTHER ORDERED, as follows: 

(1) (A) The Custodians of Records shall 

produce to NSA upon service of the appropriate secondary order, 
and continue production on an ongoing daily basis thereafter for 
the duration of this order, unless otherwise ordered by the 
Court, an electronic copy of the following tangible things: all 

call detail records or "telephony metadata" 1 created byB 



(B) The Custodian of Records of 




1 For purposes of this Order "telephony metadata" includes 
comprehensive communications routing information (e.g., 
originating and terminating telephone number, International 
Mobile Subscriber Identity (IMSI) number, International Mobile 
station Equipment Identity (IMEI) number, etc.), trunk 
identifier, telephone calling card numbers, and time and 
duration of call. Telephony metadata does not include the 
substantive content of any communication, as defined by 18 
U.S.C. § 2510(8), or the name, address, or financial information 
of a subscriber or customer. 
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basis thereafter for the duration of this order, unless 
otherwise ordered by the Court, an electronic copy of the 
following tangible things: all call detail records or "telephony 
metadata" created by for communications (i) between the 

United States and abroad; or (ii) wholly within the United 
States, including local telephone calls. . __ 




result of this Order (information that is passed or "tipped" to 
it by NSA) , the FBI shall follow as minimization procedures the 
procedures set forth in The Attorney General's Guidelines for 
Domestic FBI Operations (September 29, 2008) . 

(3) With respect to the information that NSA receives as a 
result of this Order, NSA shall strictly adhere to the following 
minimization procedures: 

A. The government is hereby prohibited from accessing 
business record metadata acquired pursuant to this Court's 
orders in the above -captioned docket and its predecessors ( "BR 
metadata") for any purpose except as described herein. 

B. The BR metadata may be accessed for the purposes of 
ensuring data integrity and developing and testing any 
technological measures designed to enable the NSA to comply with 
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the Court's orders. Access to the BR metadata for such purposes 
shall be limited to the NSA Collection Managers, Data Integrity 
Analysts, and System Administrators described in paragraphs 17- 
19 of the Declaration of Chief, Special FISA 

Oversight and Processing, Oversight and Compliance, Signals 
Intelligence Directorate, the National Security Agency, filed as 
Exhibit A to the Application in the above -captioned docket 
( ’^^^^Declaration" ) • Additional individuals directly involved 
in developing and testing any technological measures designed to 
enable the NSA to comply with the Court's orders may be granted 
access, provided such access is approved by NSA' s Office of 
General Counsel (OGC) on a case-by-case basis. 

C. The government may request through a motion, permission 
from the Court to use specific telephone identifiers 2 that 
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satisfy the reasonable articulable suspicion standard 3 to query 



3 The reasonable articulable suspicion standard is met when, 
based on the factual and practical considerations of everyday 
life on which reasonable and prudent persons act, there are 
facts giving rise to a reasonable, articulable suspicion that 
the telephone identifier is associated with 

provided, however, that any 
telephone identifier believed to b e used by a U.S. person shal l 
not be regarded as associated with 

gnl y on fhp haais of arHvhipa t-hah 

are protected by the First Amendment to the Constitution. 
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the BR metadata for purposes of obtaining foreign intelligence 
information through contact chaining 

as described in the ^^^^Declaration at 6-7, on a 
case-by-case basis. In addition, if the government determines 
that immediate querying of the BR metadata through contact 
chaining is necessary to protect against an 
imminent threat to human life, the government may query the BR 
metadata for such purpose. In any case falling into this latter 
category, the government shall notify the Court of the access, 
in writing, no later than 5:00 p.m. , Eastern Time on the next 
business day after such access. Any submission to the Court 
under this paragraph shall, at a minimum, specify the telephone 
identifier for which access is sought or was granted, provide 
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the factual basis for the NSA's belief that the reasonable 
articulable suspicion standard has been met with regard to that 
identifier 4 and, if such access has already taken place, a 
statement of the immediate threat necessitating such access. 

Only the Chief, Special FISA Oversight and Processing, Oversight 
and Compliance, Signals Intelligence Directorate; the Chief or 
Deputy Chief, Homeland Security Analysis Center; or one of the 
twenty specially-authorized Homeland Mission Coordinators in the 
Analysis and Production Directorate of the Signals Intelligence 
Directorate shall be authorized to access the BR metadata for 
purposes of implementing this sub -paragraph . 

D. For the duration of the authorization granted by this 
Order, the NSA may use certain telephone identifiers previously 
approved by the Court in docket number BR 09-01, specifically, 
only those ^^|t el ephone identifiers described in Tab 1 to the 
J^HHDeclaration, to conduct queries of the BR metadata for 
purposes of obtaining foreign intelligence information through 



4 For telephone identifiers that are currently subject to Court- 
authorized electronic surveillance, pursuant to 50 U.S.C. § 

1805, based on this C ourt's finding of probable cause to b elieve 
that they are used by 

including those used by U.S. persons, 
the government's submission need only provide the target's name, 
docket number, and date of expiration of this Court's most 
recent authorization of electronic surveillance. 
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contact chaining 




in accordance with this 



Order. If NSA has knowledge of the discontinued use of any such 
identifier, its analysis and minimization of information 
retrieved from the queries based on any such identifier should 
be informed by the knowledge of discontinued use of the 
identifier . 

E. The Director of the NSA shall continue to maintain 
mandatory procedures to strictly control access to and use of 
the BR metadata, in accordance with this Court's orders. 

F. The NSA shall obtain the BR metadata from 



and process the BR metadata on a secure internal network that 
NSA exclusively will operate. 

G. Any processing by technical personnel of the BR metadata 
acquired pursuant to this order shall be conducted through the 
NSA' s secure internal network, which shall be accessible only to 
cleared technical personnel, using accounts authorized by a user 
authentication service, based on user login and password. 

H. Access to the BR metadata shall be accomplished through 
a software interface that will limit access to this data to 
authorized personnel. NSA' s Oversight and Compliance Office 
shall monitor the designation of individuals with access to the 
BR metadata. Access to the metadata shall be controlled by user 





via dedicated secure lines, and shall store 
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name and password. When the metadata is accessed, the user's 
login, Internet Protocol (IP) address, date and time, and 
retrieval request shall be automatically logged for auditing 
capability. NSA' s OGC shall monitor the functioning of this 
automatic logging capability. Persons authorized for access to 
the BR metadata shall be briefed by NSA's OGC concerning the 
authorization granted by this Order and the limited 
circumstances in which queries to the metadata are permitted, as 
well as other procedures and restrictions regarding the 
retrieval, storage, and dissemination of the metadata. 

I. Any dissemination of U.S. person information shall 
follow the standard NSA minimization procedures found in USSID 
18. Before information identifying a U.S. person may be 
disseminated outside of NSA, a j udgment must be made that the 
identity of the U.S. person is necessary to understand the 
foreign intelligence information or to assess its importance. 
Prior to the dissemination of any U.S. person identifying 
information, the Chief of Information Sharing Services in the 
Signals Intelligence Directorate must determine that the 
information identifying the U.S. person is in fact related to 
counterterrorism information and that it is necessary to 
understand the counterterrorism information or assess its 
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importance. 5 A record shall be made of every such determination. 

J. At least once before the expiration of the authorities 
granted herein, NSA's OGC shall conduct a random spot check, 
consisting of an examination of a sample of call detail records 
obtained, to ensure that NSA is receiving only data as 
authorized by the Court and not receiving the substantive 
content of communications , 

K. The BR metadata collected under this Court's Orders may 
be kept online (that is, accessible for queries) for five years 
from the date of acquisition, at which time it shall be 
destroyed . 

L. The Chief, Special FISA Oversight and Processing, 
Oversight and Compliance, Signals Intelligence Directorate; 

Chief and Deputy Chief, Homeland Security Analysis Center; and 
the Homeland Mission Coordinators shall maintain appropriate 
management controls (e.g., records of all tasking decisions, 
audit and review procedures) for access to the metadata and 
shall use the USSID 18 to minimize the information reported 
concerning U.S. persons. 

M. The government shall implement the additional oversight 
mechanisms to ensure compliance with this Order: 

5 The Court understands that the Senior Operations Officer at 
NSA' s National Security Operation Center is the approving 
authority for after-hours requests. 
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(i) NSA's OGC shall consult with the Department of 
Justice's National Security Division {NSD) on all 
significant legal opinions that relate to the 
interpretation, scope, and/or implementation of the 
authorizations granted by the Court in this matter. When 
operationally practicable, such consultation shall occur in 
advance; otherwise, NSD shall be notified as soon as 
practicable . 

(ii) NSA's OGC shall promptly provide NSD with copies 
of the mandatory procedures {and all replacements, 
supplements or revisions thereto in effect now or adopted 
in the future) the Director of NSA is required to maintain 
to strictly control access to and use of the data acquired 
pursuant to orders issued by the Court in this matter. 

(iii) NSA's OGC shall promptly provide NSD with copies 
of all formal briefing and/or training materials (including 
all revisions thereto) currently in use or prepared and 
used in the future to brief/train NSA personnel concerning 
the authorizations granted by this Order. 

(iv) At least once before the expiration of the 
authorities granted herein, a meeting for the purpose of 
assessing compliance with this Court's orders in this 

matter shall be held with representatives from NSA's OGC, 
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NSD, and appropriate individuals from NSA' s SID. The 
results of this meeting shall be reduced to writing and 
submitted to the Court as part of any application to renew 
or reinstate the authorities granted herein. 

(v) At least once before the expiration of the 
authorities granted herein, NSD shall meet with NSA' s 
Office of Inspector General (OIG) to discuss their 
respective oversight responsibilities and assess NSA' s 
compliance with the Court's orders in this matter. 

(vi) Prior to implementation, all proposed automated 
query processes shall be reviewed and approved by NSA' s 
OGC, NSD, and the Court. 

N. Any application to renew or reinstate the authority 

granted herein shall include a report describing: (i) the 

queries made since the end of the reporting period of the last 
report filed with the Court; and < i i } any proposed changes in 
the way in which the call detail records would be received from 
the carriers . 

O. Upon completion of the government's end-to-end system 
engineering and process reviews, described in Memorandum of the 
United States In Response to the Court's Order Dated January 28, 
2009, Tab 1, Declaration of Lieutenant General Keith B. 

Alexander, United States Army, Director of the NSA, filed 
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February 17, 2009, at 21, the government shall file a report 
with the Court, that shall, at a minimum, include: 

(i) an affidavit by the Director of the FBI, and 
affidavits by any other official responsible for national 
security that the government deems appropriate, describing 
the value of the BR metadata to the national security of 
the United States and certifying that the tangible things 
sought are relevant to an authorized investigation (other 
than a threat assessment) to obtain foreign intelligence 
information not concerning a U.S. person or to protect 
against international terrorism or clandestine intelligence 
activities, and that such investigation of a U.S, person is 
not conducted solely on the basis of activities protected 
by the First Amendment; 

(ii) a description of the results of the NSA's end-to- 
end system engineering and process reviews, including any 
additional instances of non-compliance identified 
therefrom; 

(iii) a full discussion of the steps taken to remedy 
any additional non-compliance as well as the incidents 
described in the Court's Order of March 2, 2009 in docket 
number BR 08-13, and an affidavit attesting that any 
technological remedies have been tested and demonstrated to 
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be successful; and 

(iv) additional minimization and oversight procedures 
the government proposes to employ should the Court decide 
to authorize the government's resumption of regular access 
to the BR metadata. 



This authorization regarding 

■and unknown persons in the United States 
and abroad affiliated with I 




and unknown persons in the United States 

and abroad affiliated with I ; ^ { - _ __ ___ / 

Bexpires on / Q th day of -M)Ly_ t 2009, 
at 5:00 p.m., Eastern Time. 



Signed 



05-29-2009 All'- 43 
Date Time 



Eastern Time 




Intelligence Surveillance Court 



flg ‘P l ity Clerk 

FiSC. certify that this document 
is a true and correct coovof 

the orscsina! ■ 
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